What DNSControl/dnscontrol shipped
Written by FoxPlug from the repository's own releases; not affiliated with Dnscontrol. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/DNSControl/dnscontrol; Dnscontrol did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- LuaDNS provider now batches RRset record changes into bulk API calls for create, update and delete. Pull request #5047
- Upgraded to the latest tomontime/dns patches, adapting to changed TSIG error behavior and different parsing of rtypes with no options. Pull request #5066
- DNSimple provider upgraded to dnsimple-go/v10, with imports and dependencies updated automatically. Pull request #5057
- Akamai EdgeDNS provider upgraded to AkamaiOPEN-edgegrid-golang/v14, with imports and dependencies updated automatically. Pull request #5056
- Updated npm dependencies. Pull request #5067
Why it matters
This week brings fewer API calls for LuaDNS users through batched record changes, plus dependency upgrades across DNSimple, Akamai EdgeDNS and the DNS library. The TSIG and rtype parsing changes from the updated dns patches mean behavior shifts that provider users may notice.
Changelog entry
- LuaDNS: batch record changes into bulk API calls Pull request #5047
- Upgrade to the latest tomontime/dns patches Pull request #5066
- DNSimple: upgrade to dnsimple-go/v10 Pull request #5057
- Akamai EdgeDNS: upgrade to AkamaiOPEN-edgegrid-golang/v14 Pull request #5056
- Update npm dependencies Pull request #5067
This week: LuaDNS record changes now batch into bulk API calls, the dns patches are updated with TSIG and rtype parsing changes, and the DNSimple and Akamai EdgeDNS providers move to newer SDK versions.
This week in DNSControl: the LuaDNS provider now batches RRset changes into bulk API calls instead of individual calls. The DNS patches from tomontime are updated, with TSIG errors and rtypes with no options now parsing differently. The DNSimple provider moves to dnsimple-go/v10 and the Akamai EdgeDNS provider moves to AkamaiOPEN-edgegrid-golang/v14, both with imports and dependencies upgraded automatically. npm dependencies were also updated.
Week of October 26, 2026
What shipped
- Cloudflare provider now sends proxy settings as configured and lets Cloudflare reject invalid ones instead of guessing which records can be proxied. Pull request #5051
- CloudPress provider now fetches each zone once and makes the retry backoff configurable, addressing HTTP 429 errors for accounts with many zones. Pull request #5046
- LUADNS provider no longer fails a push on occasional 500 responses to valid updates. Pull request #5042
- Azure DNS provider no longer reports intermittent resource type mismatch errors on record create and update. Pull request #5040
- BIND provider no longer mangles repeated zone labels when writing zone files. Pull request #5037
- DNSimple provider supports URL as a record type again. Pull request #5054
- Version v5.7.2 was released. Release
- Version v5.7.1 was released. Release
- Dependencies were updated. Pull request #5055
Why it matters
This week brought fixes across several providers, including Cloudflare proxy handling, CloudPress zone fetching and retries, LUADNS and Azure DNS intermittent failures, and BIND zone file output. It also corrected IGNORE pattern behavior and restored URL support for DNSimple. Two patch releases, v5.7.1 and v5.7.2, shipped alongside these changes.
Changelog entry
- Cloudflare: proxy settings are sent as configured; Cloudflare decides what is invalid. Pull request #5051
- CloudPress: each zone fetched once; retry backoff is configurable. Pull request #5046
- LUADNS: occasional 500 on valid updates no longer fails a push. Pull request #5042
- Azure DNS: fixed intermittent resource type mismatch errors on record create and update. Pull request #5040
- BIND: repeated zone labels are no longer mangled in zone files. Pull request #5037
- DNSimple: URL added back as a supported type. Pull request #5054
- Release v5.7.2. Release
- Release v5.7.1. Release
- Dependency updates. Pull request #5055
- Dependency updates. Pull request #5039
Week of October 19, 2026
What shipped
- Added a DNS provider for Constellix using their DNS v4 API, closing the long-standing request for Constellix support. Pull request #5029
- IGNORE_TARGET now matches the target of existing HTTPS and SVCB records, so preview no longer proposes deleting records the config says to ignore. Pull request #5028
- MODIFY messages now show provider-specific fields added through a ComparableFunc, so a change only in such a field appears as an actual difference. Pull request #5030
- D_EXTEND now ignores the empty tag when extending a subdomain, so writing the tag on only one of the two names no longer puts records under the wrong name or panics. Pull request #5034
- LOC now preserves thousandths of arcseconds in coordinates instead of rounding seconds to two decimals. Pull request #5035
- The Namecheap provider no longer corrupts TXT records longer than 255 bytes when pushing them. Pull request #5036
- LOC_BUILDER_DD now accepts zero coordinates and rejects a missing y instead of emitting a record at longitude zero. Pull request #5027
- BIND GetZones now works when filenameformat includes %f or %F, so zones written as
db_example.comare found. Pull request #5026 - DKIM_BUILDER now encodes non-ASCII notes as UTF-8 octets in the n= tag. Pull request #5024
- Get-zones with JS output now writes HTTPS, SVCB and DNSKEY records in a form dnsconfig.js can load. Pull request #5015
Why it matters
This week brings a new provider, Constellix, and fixes several cases where preview or push could mislead: IGNORE_TARGET on HTTPS and SVCB targets, MODIFY output that hid provider-specific field changes, and D_EXTEND mishandling the empty tag. Record handling is also more correct for LOC precision, long Namecheap TXT records, DKIM non-ASCII notes, BIND zone discovery with %f in filenameformat, and get-zones JS output for HTTPS, SVCB and DNSKEY.
Changelog entry
- Feat(p/CONSTELLIX): add Constellix DNS provider Pull request #5029
- Fix: make IGNORE_TARGET match HTTPS and SVCB targets Pull request #5028
- Fix(diff2): MODIFY messages now show provider-specific fields Pull request #5030
- Fix(D_EXTEND): ignore the empty tag when extending a subdomain Pull request #5034
- Fix(LOC): preserve thousandths of arcseconds in coordinates Pull request #5035
- Fix(p/NAMECHEAP): stop corrupting TXT records longer than 255 bytes Pull request #5036
- Fix(LOC_BUILDER_DD): accept zero and reject missing coordinates Pull request #5027
- Fix(p/BIND): improve GetZones when filenameformat includes %f or %F Pull request #5026
- Fix(DKIM_BUILDER): encode non-ASCII notes as UTF-8 octets Pull request #5024
- Fix: make get-zones js output load for HTTPS, SVCB and DNSKEY records Pull request #5015
- Feat(FORSALE_BUILDER): add a builder for RFC 10023 _for-sale records Pull request #5014
- Ci: fix harden-runner pin SHA in fuzzing workflow Pull request #5016
V5.7.0 adds Constellix DNS support. This week: IGNORE_TARGET now matches HTTPS/SVCB targets, MODIFY shows provider-specific fields, D_EXTEND ignores the empty tag, LOC keeps thousandths of arcseconds, and get-zones JS output loads HTTPS, SVCB and DNSKEY records.
This week's changes include a new Constellix DNS provider in v5.7.0. IGNORE_TARGET now matches HTTPS and SVCB record targets, and MODIFY messages show provider-specific fields such as proxy settings, so preview reflects what actually changed. D_EXTEND ignores the empty tag, LOC preserves thousandths of arcseconds, Namecheap no longer corrupts TXT records over 255 bytes, and DKIM_BUILDER encodes non-ASCII notes as UTF-8. BIND GetZones handles %f and %F in filenameformat, and get-zones JS output now loads for HTTPS, SVCB and DNSKEY records.
Week of October 12, 2026
What shipped
- Released v5.5.0, which highlights the new MISAKA provider, the new CSYNC record type for NETNOD and BIND, and a third major change listed in the release notes. Release
- Added the MISAKA provider for Misaka.io Managed DNS using their v3 API, with record-set based diffing. Pull request #4994
- Added the CSYNC record type (RFC 7477) for NETNOD, along with documentation and feature matrix entries. Pull request #4988
- Limited require() and require_glob() to the working and config directories, closing off absolute paths, parent-relative paths, and symlinks that escape the config tree. Pull request #5012
- Made DMARC_BUILDER reject invalid policy and tag values instead of passing typos into the TXT record unchanged. Pull request #5013
- Fixed D_EXTEND() handling of IPv6 PTR labels in.ip6.arpa zones, which previously discarded the label. Pull request #5010
- Preview MODIFY messages now list each changed field in name=(old->new) form. Pull request #4990
- ClouDNS now recognizes WR redirect records from the API instead of rejecting them as an invalid type. Pull request #4992
- Added Go fuzzing targets and scheduled fuzzing in CI, which found real panics in the dnsconfig.js import path. Pull request #5006
- Fixed several invalid JavaScript examples in the documentation, including MX priorities and targets, SPF and TXT syntax, and FortiGate domain metadata. Pull request #4984
Why it matters
This week brought a release with a new provider and a new record type, so users of Misaka.io DNS and NETNOD CSYNC have new support to try. Several fixes address configuration safety and correctness: require() is now confined to the config tree, DMARC_BUILDER rejects bad values, and IPv6 PTR labels in D_EXTEND behave properly. A large batch of refactoring around provider capability and record-type definitions also landed, changing internal registration structure without changing field values.
Changelog entry
- Release v5.5.0: new MISAKA provider, CSYNC record type, and more. Release
- Feat(p/MISAKA): add Misaka.io DNS provider using the v3 API. Pull request #4994
- Feat(p/NETNOD): add CSYNC record type (RFC 7477) with docs and feature matrix entry. Pull request #4988
- Feat(js): limit require() and require_glob() to the working and config directories. Pull request #5012
- Fix: DMARC_BUILDER now rejects invalid policy and tag values. Pull request #5013
- Fix: D_EXTEND() correctly handles IPv6 PTR labels in.ip6.arpa zones. Pull request #5010
- Feat(preview): MODIFY messages show which fields changed as name=(old->new). Pull request #4990
- Fix(p/CLOUDNS): recognize WR redirect records. Pull request #4992
- Test: add Go fuzzing targets and scheduled fuzzing CI. Pull request #5006
- Docs: fix invalid JavaScript examples, including MX priorities, SPF/TXT syntax, and FortiGate metadata. Pull request #4984
- Ci: add OpenSSF Scorecard analysis workflow. Pull request #4993
- Chore: update dependencies. Pull request #5008
V5.5.0 is out: new MISAKA provider, new CSYNC record type for NETNOD and BIND. This week also confined require() to the working and config directories, made DMARC_BUILDER reject bad policy values, fixed IPv6 PTR labels in D_EXTEND for.ip6.arpa zones, and made preview MODIFY messa
DNSControl v5.5.0 is out. It adds a MISAKA provider for Misaka.io Managed DNS and the CSYNC record type (RFC 7477), supported by NETNOD and BIND. This week also tightened config safety: require() and require_glob() are now limited to the working and config directories, DMARC_BUILDER rejects invalid policy and tag values instead of writing typos into TXT records, and D_EXTEND() correctly handles IPv6 PTR labels in.ip6.arpa zones. Preview output now lists which fields changed on MODIFY, and ClouDNS recognizes WR redirect records. Documentation examples with invalid JavaScript were corrected, and Go fuzzing was added to CI.
Week of October 5, 2026
What shipped
- Released v5.4.0, which adds CloudPress DNS support and an experimental D() syntax for declaring registrars and providers. Release
- Added a CloudPress DNS provider, verified end to end against a live CloudPress account. Pull request #4390
- Added direct REGISTRAR and SERVICE syntax so credentials can be selected in domain declarations without NewRegistrar or NewDnsProvider. Pull request #4976
- Added a SKIP_AUDIT modifier so a provider's RecordAuditor can no longer block changes when the provider's API accepts the records. Pull request #4971
- Made the BUNNYDNS provider safe to run concurrently by adding synchronization around its map of account zones. Pull request #4980
- Fixed BUNNYDNS GetNameservers to return the zone's nameservers and ignore apex NS records. Pull request #4970
- Marked the DNSOVERHTTPS provider as verified for concurrency. Pull request #4981
- Reduced serially checking and serially gathering messages when all providers are concurrent, with --full overriding. Pull request #4979
- Fixed the HUAWEICLOUD provider to allow CNAME records to co-exist with GeoDNS lines. Pull request #4987
- Added SupportedTypes and exhaustive provider validation, reported as a list instead of per-type registration. Pull request #4967
Why it matters
This week brings a new release with a new provider and an experimental syntax that changes how domains declare registrars and providers. Provider work also moved toward concurrency and a redesigned type and registration model, which affects how providers are validated and registered. Fixes landed for BUNNYDNS nameservers and HUAWEICLOUD CNAME handling with GeoDNS.
Changelog entry
- Release v5.4.0: new CloudPress provider and experimental D() syntax. Release
- Add the CloudPress DNS provider. Pull request #4390
- Add direct REGISTRAR and SERVICE syntax in domain declarations. Pull request #4976
- Add the SKIP_AUDIT modifier to bypass provider record audit failures. Pull request #4971
- Make BUNNYDNS safe to run concurrently. Pull request #4980
- Fix BUNNYDNS GetNameservers and ignore apex NS records. Pull request #4970
- Mark DNSOVERHTTPS as verified for concurrency. Pull request #4981
- Reduce serially checking and gathering messages when all providers are concurrent. Pull request #4979
- Fix HUAWEICLOUD CNAME co-existence with GeoDNS. Pull request #4987
- Add SupportedTypes and exhaustive provider validation. Pull request #4967
- Adopt SupportedTypes across providers. Pull request #4968
- Update dependencies. Pull request #4973
V5.4.0 is out: CloudPress DNS support, plus an experimental D() syntax for registrar and provider declarations. Also this week: direct REGISTRAR/SERVICE syntax, a SKIP_AUDIT modifier, BUNNYDNS concurrency and nameserver fixes, and DNSOVERHTTPS marked concurrent.
V5.4.0 is released, adding CloudPress DNS as a provider and an experimental D() syntax for registrar and provider declarations. Also shipped: direct REGISTRAR and SERVICE syntax for selecting credentials in domain declarations, a SKIP_AUDIT modifier for records a provider accepts but its auditor rejects, and BUNNYDNS fixes for concurrent runs and for returning a zone's nameservers. DNSOVERHTTPS is now marked verified for concurrency, and serially checking messages are reduced when all providers run concurrently. Provider validation also gained a SupportedTypes list.
Week of September 28, 2026
What shipped
- V5.3.0 released with a new syntax for provider configuration alongside the existing syntax. Release
- New PROVIDER(), REGISTRAR(), and DNS_SERVICE() syntax added as an alternative to the D() function for defining providers in dnsconfig.js. Pull request #4955
- Infoblox NIOS DNS provider added, supporting A, AAAA, CAA, CNAME, MX, PTR, SRV, and TXT records. Pull request #4846
- BunnyDNS provider now supports managing health monitoring features via dnsconfig.js. Pull request #4951
- BunnyDNS provider gains GeoDNS metadata support for smart records configuration. Pull request #4941
- Fixed crash in dnscontrol check when IMPORT_TRANSFORM references a non-existent domain. Pull request #4969
- Record field normalization expanded to handle all targethost and hex-encoded fields consistently. Pull request #4944
- FortiGate provider init now uses yes/no prompts for TLS and HTTP debug settings instead of free text. Pull request #4878
- RealTimeRegister provider now properly quotes TXT records. Pull request #4945
- README provider table is now autogenerated to stay current. Pull request #4948
Why it matters
This week brings v5.3.0 with a cleaner provider configuration syntax that addresses long-standing user confusion, plus two major provider additions (Infoblox NIOS and expanded BunnyDNS features) and important bug fixes including a crash prevention in config validation. The autogenerated README table ensures provider compatibility information stays accurate going forward.
Changelog entry
- V5.3.0 released Release
- New PROVIDER(), REGISTRAR(), and DNS_SERVICE() syntax for provider configuration Pull request #4955
- NEW PROVIDER: Infoblox NIOS DNS with A, AAAA, CAA, CNAME, MX, PTR, SRV, TXT support Pull request #4846
- BunnyDNS: health monitoring feature management support Pull request #4951
- BunnyDNS: GeoDNS/smart records metadata support Pull request #4941
- Fix: prevent crash when IMPORT_TRANSFORM references non-existent domain Pull request #4969
- Normalize all targethost and hex-encoded record fields for consistent comparison Pull request #4944
- FortiGate: init now uses yes/no prompts for
insecure_tlsanddebug_httpPull request #4878 - RealTimeRegister: proper TXT record quoting Pull request #4945
- README provider table now autogenerated Pull request #4948
- Refactor: reduce unused metadata parameters in provider initialization Pull request #4959
- Dependencies updated Pull request #4957
V5.3.0 shipped with new PROVIDER/REGISTRAR/DNS_SERVICE syntax, Infoblox NIOS provider support, and crash fixes. Both old and new syntax are supported.
DNSControl v5.3.0 is out! This release introduces cleaner provider configuration syntax (PROVIDER/REGISTRAR/DNS_SERVICE) alongside the existing D() function, adds support for Infoblox NIOS DNS management, expands BunnyDNS with health monitoring and GeoDNS features, and fixes several bugs including a crash in config validation. The provider compatibility table in the README is now autogenerated for accuracy.
Week of September 21, 2026
What shipped
- DNSControl v5.2.0 released with contributions from the community. Release
- Mittwald mStudio added as a new DNS provider using the official Go client. Pull request #4933
- Spaceship added as both a registrar and DNS provider. Pull request #4921
- OpenProvider added as a new DNS service provider supporting A, AAAA, CAA, CNAME, MX, SPF, SRV, TLSA, and TXT records. Pull request #4891
- M365_BUILDER rewritten in Go with updated records to match Microsoft's current requirements. Pull request #4936
- AZURE_PRIVATE_DNS provider now supports the same authentication methods as AZURE_DNS including OIDC. Pull request #4929
- OpenProvider provider improved with retry logic and exponential backoff for transient API failures. Pull request #4937
- CNAME target values are now lowercased during normalization. Pull request #4940
- Fixed a JSON injection security vulnerability in get-zone --format js output. Pull request #4928
- Integration tests now run on scheduled CI runs instead of being skipped. Pull request #4935
Why it matters
This release adds three new providers (Mittwald, Spaceship, and OpenProvider) expanding DNS management options. Existing Azure and M365 providers received significant improvements with better authentication support and updated configurations. Security and reliability fixes address a JSON injection vulnerability and transient API failures.
Changelog entry
- NEW PROVIDER: Mittwald mStudio DNS provider Pull request #4933
- NEW PROVIDER: Spaceship registrar and DNS provider Pull request #4921
- NEW PROVIDER: OpenProvider DNS service provider with support for A, AAAA, CAA, CNAME, MX, SPF, SRV, TLSA, TXT records Pull request #4891
- AZURE_PRIVATE_DNS: Added OIDC support and same authentication methods as AZURE_DNS Pull request #4929
- M365_BUILDER: Rewritten in Go with updated records to Microsoft's current requirements Pull request #4936
- OPENPROVIDER: Added retry logic with exponential backoff for transient API failures Pull request #4937
- Fixed: CNAME target rdata now lowercased in normalization Pull request #4940
- Fixed: JSON injection vulnerability in get-zone --format js Pull request #4928
- Fixed: Integration tests now run on scheduled CI runs Pull request #4935
- Improved: Test length adjusted per provider Pull request #4939
- Improved: Providers can declare record identity for duplicate checks Pull request #4883
- Documentation: Rewrote golden file documentation Pull request #4912
- Documentation: Fixed table of contents links to resolve on GitBook Pull request #4932
DNSControl v5.2.0 is out! New providers: Mittwald, Spaceship, OpenProvider. Improved Azure and M365 support. Security and reliability fixes. Thanks to all contributors!
DNSControl v5.2.0 released! This version adds three new DNS providers—Mittwald mStudio, Spaceship, and OpenProvider—while strengthening existing integrations. Azure Private DNS now supports OIDC authentication, and M365_BUILDER has been rewritten in Go with updated record requirements. Security improvements include a JSON injection vulnerability fix. Thanks to our community contributors!
Week of September 14, 2026
What shipped
- V5.1.0 released as the first production-ready release after v5.0.0. Release
- SCALEWAY provider fixed for TXT round-trip handling, SVCB parameters, SSHFP case sensitivity, NS TTL, and PTR support. Pull request #4919
- GCORE provider fixed to parse API names without trailing dots. Pull request #4923
- SVCB keys without values like no-default-alpn now handled correctly. Pull request #4909
- INWX sandbox question in dnscontrol init changed from confusing free text to yes/no prompt. Pull request #4882
- AUTODNS provider fixed to send bare FQDN as MX value instead of full RDATA. Pull request #4880
- AUTODNS provider fixed to clear legacy zone-level main record on update. Pull request #4881
- TENCENTDNS provider now matches package grades case-insensitively. Pull request #4884
- Documentation updated to point new users to dnscontrol init first. Pull request #4910
- Daily integration tests re-enabled. Pull request #4911
Why it matters
V5.1.0 brings multiple provider bug fixes discovered through integration testing, improving reliability for users of SCALEWAY, GCORE, AUTOWNS, TENCENTDNS, and other providers. Documentation improvements ensure new users get correct setup guidance and existing users find accurate reference information.
Changelog entry
- V5.1.0 released Release
- Fix(p/SCALEWAY): correct TXT round-trip, SVCB params, SSHFP case, NS TTL, and PTR support Pull request #4919
- Fix(p/GCORE): parse API names without a trailing dot Pull request #4923
- Fix: SVCB keys that lack a value (no-default-alpn, others) not handled correctly Pull request #4909
- Fix(p/INWX): ask the sandbox setting as a yes/no question in init Pull request #4882
- Fix(p/AUTODNS): send bare FQDN as MX value, not full RDATA Pull request #4880
- Fix(p/AUTODNS): clear the legacy "main" record on zone update Pull request #4881
- Fix(p/TENCENTDNS): match package grades case-insensitively Pull request #4884
- Fix(p/CNR): offer the debug mode levels as a list in init Pull request #4879
- Docs: point new users to dnscontrol init first Pull request #4910
- Ci: Re-enable daily integration tests Pull request #4911
DNSControl v5.1.0 is out. This release fixes five SCALEWAY provider issues, SVCB/HTTPS record handling, MX record bugs in AUTOWNS and TENCENTDNS, plus improved init prompts and docs.
DNSControl v5.1.0 is now available for production use. This release addresses multiple provider bugs discovered through integration testing: SCALEWAY round-trip fixes, SVCB key handling, AUTOWNS MX preference and TENCENTDNS package grade matching. Documentation improvements help new users get started with dnscontrol init, and integration tests are back online.